EU Compliance Risk Assessment

Business Profile

Tell us about your organisation so we can tailor the risk assessment to your situation.

How many people work at your company?

Full-time equivalent employees globally

1–10 employees Micro / startup

11–50 employees Small business

51–200 employees Mid-size

200+ employees Enterprise

What industry are you in?

Select your primary sector — certain industries face stricter EU obligations

Where are most of your customers or users?

Your primary customer geography determines baseline EU exposure

Australia only

APAC region (including Australia)

Global — customers across multiple regions

EU-focused EU is a significant or primary market

EU Exposure

Select everything that applies to your business. This determines which EU regulations are in scope for you.

Which of the following apply to your business?

Tick all that apply — this is the primary driver of your risk score

We sell products or services to EU-based customers

We collect or process personal data of EU residents (customers, users, or employees)

We employ or contract staff based in the EU

We supply services to EU-regulated entities (banks, insurers, or critical infrastructure operators)

We build or operate AI systems or AI-powered products accessible by EU users

We use US-headquartered cloud providers to store or process EU customer data

We have EU subsidiaries, branch offices, or EU-registered legal entities

None of the above apply to our business

Current Compliance Status

Rate your organisation's compliance posture for each key EU regulation. Be honest — this generates a more useful result.

Policies & procedures

These directly affect your GDPR and NIS2 obligations

Data Protection Officer (DPO)

Yes — formally designated DPO in place

Informal — someone handles it, no official appointment

No DPO or equivalent

Incident response plan

Yes — documented, tested, and regularly reviewed

Draft exists but hasn't been tested

No incident response plan

Breach notification procedures

Yes — written procedures with clear timelines and owners

Partial — some guidance but not fully documented

No breach notification procedures

Data & Infrastructure

Where your data lives and how it moves across borders significantly affects your compliance risk and sovereignty obligations.

Where is your primary data stored?

The physical and legal jurisdiction of your data is a key compliance factor

Australia only Local servers or AU-region cloud (e.g. AWS ap-southeast-2)

US-based cloud AWS us-east, Azure US, GCP us-central — data physically in the US

EU-region cloud AWS EU, Azure EU, GCP EU regions

Multi-region Data spread across AU, US, EU, or other regions

I don't know Unsure where data is physically or legally located

Which cloud providers do you use?

Select all that apply — US-headquartered providers carry Schrems II transfer risk for EU data

Amazon Web Services (AWS)

Microsoft Azure

Google Cloud Platform (GCP)

Other / On-premise / EU-sovereign provider

Data governance activities

Have you completed these key activities required by GDPR and EU data regulations?

Data sovereignty assessment

Yes — completed and documented

In progress

Not yet started

Data Processing Agreements (DPAs) with all vendors

Yes — all vendors have signed DPAs

Some vendors covered, not all

No DPAs in place

Cross-border data flow mapping

Yes — documented and kept current

Partially mapped

Not mapped